HackingRetail & ConsumerHealthcareRetailStolen CredentialsSupply Chain (3P Vendor)Customer Data InvolvedData ExfiltratedIdentity (basic)Financial accountFinancial credentialsCredentialsLowContained

CVS Pharmacy, Inc.

bd_fc4af90e78d486c1 · schema v1 · pii pii-v1

Severity

Low

Discovered

Jul 1, 2015

Filed

Sep 11, 2015

To disclose

10 weeks

Affected

Not disclosed

Linked

4 filings

Confidence

64%

Full breach record for CVS Pharmacy, Inc. →9 incidents on file

CVS Pharmacy, Inc. disclosed an unauthorized intrusion into the systems of its independent vendor, PNI Digital Media, which hosted the CVSPhoto.com website. The intrusion occurred between June 2014 and July 2015 and potentially resulted in the unauthorized acquisition of payment card numbers, verification codes, names, addresses, phone numbers, email addresses, and usernames/passwords. CVS took down the website, engaged forensic investigators, and offered one year of credit monitoring to affected customers.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 395 days

discovery → filing · 10 weeks / 72 days

Jun 1, 2014

Begins

Jul 1, 2015

Discovered

Sep 11, 2015

Filed

vs. sector median

+3 wks slower

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Massachusetts State AGbd_8534ceb654eebac52015-09-11Verified
New Hampshire State AGbd_0146674d7aa449bb2015-09-10 · +1dVerified
South Carolina State AGbd_c170bb3c6ed5a8cb2015-09-14 · +3dVerified

Name: CVS Pharmacy, Inc.
norm: cvs pharmacy
Domain: cvs.com

Name: CVS Pharmacy, Inc.
norm: cvs pharmacy
Domain: cvs.com
Industry: Retail & ConsumerllmHealthcarellm

Discovered: Jul 1, 2015
Breach occurred: Jun 1, 2014 – Jul 31, 2015
Undetected for: 395 daysoccurrence → discovery
Materiality determined: —
Notification sent: Sep 11, 2015
Affected individuals: Not disclosed
Data types: Identity (basic)Financial accountFinancial credentialsCredentials
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
Threat actor: External
Third party: via PNI Digital Media
Initial access: supply_chain

During the incident: Promptly took down the website
Began working with PNI to investigate the reports
Working with PNI and experienced forensic investigators
Arranged for customers to receive one year of free credit monitoring and resolution of identity theft through Experian’s ProtectMyID Alert
Advised the three major U.S. credit reporting agencies about this incident
Changes made: Reviewing the security practices for the vendor host
Working diligently to re-launch the website
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 10 weeks(72 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

New Hampshire State AGSep 10 · first

Massachusetts State AG+1d

California State AG+1d · this page

South Carolina State AG+4d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-57763
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 11, 2015
Raw hash: 24c88413ee2e3ec01421a320e1b284af3a57be30ae7294f9c9c846c9bf5d01a6

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityCVS Pharmacy, Inc.

Victim entityCVS Pharmacy, Inc.

Incidentdiscovered Jul 1, 2015

Stated responsePromptly took down the website

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov